Windows Error Reporting flooding event viewer

Question

I'm having an issue where Windows Error Reporting keeps sending the logs located in C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ to and spamming Event Viewer (application) with Eventid 1001 logs. I'm having this problem with several servers. The "errors" that it reports could have happened a long time ago, it seems like it is "stuck" in this Reportqueue folder.

I can remove or delete the contents of the Reportqueue folder but when a new report comes in it seems to be "stuck" in this folder and again keeps repeating in Event viewer.

Have any of you had this problem and solved it somehow?

Have you enabled or disabled WER completely?

Screenshots of event viewer and reportqueue folder:

https://i.stack.imgur.com/ze3bR.jpg

https://i.stack.imgur.com/cSXKw.jpg

Thanks in advance!

Answer 1

WER can be disabled via a registry key.

From https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings

WER settings are located in one of the following registry subkeys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting

The subkey to disable WER:

Disabled

REG_DWORD

Possible values:

0 - Enabled (default) 1 - Disabled Enable or disable WER

Also having any of the following subkeys would lead to 'stuck' reports.

• CorporateWERDirectory
• CorporateWERPortNumber
• CorporateWERServer
• CorporateWERDirectory
• CorporateWERDirectory